Biometric versus other Two Factor Authentication Mechanisms

Question

Over the years biometrics is the go-to movie authentication mechanism, but in the real world I'm getting conflicting opinions about it. Everything I've learned shows that biometrics are flawed because of two main reasons: they are non-revokable credentials, and they can easily be forged.

So what is the state of the nation when it comes to biometrics usage compared to other mechanisms like smart cards or OTP?

Answer 1

There's a few other reasons:

• Error rate - false accepts and false rejects are still unacceptably high for many types of biometrics.
• User acceptance - still not widely trusted by users - the various privacy concerns are still quite high, and the idea that a part of your body is now a security mechanism is somewhat freaky for some folks.

Security best practices these days (like the CISSP certification's baseline for security practices) don't point towards Biometrics being the end-all, be-all for security. The best practice is to build a system with a collection of authentication mechanisms that are appropriate for the system, the information in it, the expected threats and vulnerabilities, and the ways that the system must be used.

I don't know that anyone could say beyond doubt what the "state of the nation" is - that's a pretty broad assertion. But I can say that common best practices don't currently force biometrics as a one size fits all solution. I'd say, at best, they are something that is still under development and treated with a certain amount of dubiousness.

Answer 2

Biometrics can also be forged, such as fingerprints. By contrast forging a 1024bit rsa key on a smartcard is much more difficult than a human fingerprint. However every from of authentication you add raises the bar for the attacker (and annoys your users). This is the basis of multi-factor authentication.

The most common form of two factor authentication I see in the corporate world is a Key Fob and a password. This is really good at defending against common attacks, such as obtaining a password hash from a database with sql injection and cracking it. If this where a bank vault, then yeah I would add biometrics as well. It depends what you are trying to protect.